Skip to content

Commit 2ae259d

Browse files
aaron-steinfeldclaude
aaron-steinfeld
and
claude
committed
fix: apply Azul eMudhra blocklist to the jlinked JRE
Overlay Azul's emudhra-block-unix.certs (SHA-256 verified) onto /jre/lib/security/blocked.certs after jlink, since jlink takes the list from jmods. Same 86 fingerprints as Zulu 11.0.33 / 21.0.13. Temporary until the base image is on a fixed Zulu release. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
1 parent 054d275 commit 2ae259d

4 files changed

Lines changed: 196 additions & 0 deletions

File tree

‎java-11/Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,17 @@ java.net.http,\
4444
jdk.zipfs\
4545
--output jre
4646

47+
# TEMP: eMudhra blocklist, see https://docs.azul.com/core/emudhra-workaround.html
48+
# jlink copies blocked.certs from the JDK's jmods, so the fixed list has to be applied to the
49+
# jlinked runtime. The file is Azul's emudhra-block-unix.certs (SHA-256 below), which has the same
50+
# fingerprints as the Zulu 11.0.33 / 21.0.13 lists. Remove this and the COPY once the base image
51+
# is Zulu 11.0.33 / 21.0.13 or newer, otherwise it would hide later blocklist updates.
52+
COPY blocked.certs /tmp/emudhra-blocked.certs
53+
RUN echo "2596bb6dda83c66d96c5a252d7b2ae1f24cc1ae3f1890223b4f3591a8d52bf10 /tmp/emudhra-blocked.certs" | sha256sum -c - \
54+
&& cp /tmp/emudhra-blocked.certs /jre/lib/security/blocked.certs \
55+
&& chmod 644 /jre/lib/security/blocked.certs \
56+
&& rm /tmp/emudhra-blocked.certs
57+
4758
# Extract java SSL certs
4859
FROM gcr.io/distroless/java-base-debian12:debug AS ssl
4960

‎java-11/blocked.certs‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
Algorithm=SHA-256
2+
0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
3+
03DB9E5E79FE6117177F81C11595AF598CB176AF766290DBCEB2C318B32E39A2
4+
08C396C006A21055D00826A5781A5CCFCE2C8D053AB3C197637A4A7A5BB9A650
5+
10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B
6+
14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD
7+
169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240
8+
1C5E6985ACC09221DBD1A4B7BBC6D3A8C3F8540D19F20763A9537FDD42B4FFE7
9+
1F6BF8A3F2399AF7FD04516C2719C566CBAD51F412738F66D0457E1E6BDE6F2D
10+
21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832
11+
2A464E4113141352C7962FBD1706ED4B88533EF24D7BBA6CCC5D797FD202F1C4
12+
31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133
13+
33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09
14+
37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8
15+
3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66
16+
3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829
17+
3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF
18+
3E11CF90719F6FB44D94EAC9A156B89BEBE7B8598F28EC58913F2BFCAF91D0C0
19+
423279423B9FC8CB06F1BB7C3B247522B948D5F18939F378ECC901126DE40BFB
20+
42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
21+
432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
22+
450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2
23+
45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE
24+
4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
25+
4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE
26+
4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C
27+
4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176
28+
50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A
29+
535D04DFCE027C70BD5F8A9E0AD4F218E9AFDCF5BBCF9B6DE0D81E148E2E3172
30+
558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB
31+
568FAF38D9F155F624838E2181B1CEB4D8459305EE652B0F810C97C3611BFE19
32+
579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512
33+
585CFE6B7436CBD4E732763A2137D7F49599BA9B1790E688FCEC799C58EB84A6
34+
59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66
35+
5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE
36+
5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B
37+
5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699
38+
62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72
39+
71CB00749B9130FB2707A2664BFF958D0FCC8E161D9674C7450BA0FC2BEAF9D3
40+
7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489
41+
75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536
42+
76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645
43+
7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2
44+
84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD
45+
8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF
46+
8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0
47+
8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82
48+
912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1
49+
98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
50+
9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
51+
9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7
52+
9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC
53+
9FADCE80D62A959F9930D748488C1E22E821F4E1E4A43584B848C2FC11E04D77
54+
A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC
55+
A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5
56+
A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC
57+
A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8
58+
A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8
59+
A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9
60+
A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083
61+
A90132CEA1D4F7185E4F688EFFD16F6AC14DFD78356A807599A5DABBEEF3333E
62+
AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986
63+
B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C
64+
B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD
65+
B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
66+
C0D1F42B9F4BF7ACC045B7BB5D4805E10737F67B6310CE505248D543D0D5FE07
67+
C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0
68+
C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222
69+
C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33
70+
CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
71+
CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978
72+
D0156949F1381943442C6974E9B5B49EF441BB799EF20477B90A89C3F33620CE
73+
D151962D954970501C60079258EBCFA38502E0A9F03CD640322B08C0A3117FE5
74+
D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F
75+
D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967
76+
D6CEAE5D9E047FAF7D797858D229AC991AD44316D1E2A37A21926D763153593A
77+
D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8
78+
DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE
79+
E0E740E4B0F8B3548181FF75B5372FAF4C70B99EC995D694ED0FB91B03FF8D21
80+
E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
81+
EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C
82+
EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E
83+
F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7
84+
FBB12938ABD86C125796EDF4162D291028890A7D6C0C1CCA75FD4B95EBFA7A1A
85+
FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD
86+
FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F
87+
FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B

‎java-21/Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,17 @@ java.net.http,\
4444
jdk.zipfs\
4545
--output jre
4646

47+
# TEMP: eMudhra blocklist, see https://docs.azul.com/core/emudhra-workaround.html
48+
# jlink copies blocked.certs from the JDK's jmods, so the fixed list has to be applied to the
49+
# jlinked runtime. The file is Azul's emudhra-block-unix.certs (SHA-256 below), which has the same
50+
# fingerprints as the Zulu 11.0.33 / 21.0.13 lists. Remove this and the COPY once the base image
51+
# is Zulu 11.0.33 / 21.0.13 or newer, otherwise it would hide later blocklist updates.
52+
COPY blocked.certs /tmp/emudhra-blocked.certs
53+
RUN echo "2596bb6dda83c66d96c5a252d7b2ae1f24cc1ae3f1890223b4f3591a8d52bf10 /tmp/emudhra-blocked.certs" | sha256sum -c - \
54+
&& cp /tmp/emudhra-blocked.certs /jre/lib/security/blocked.certs \
55+
&& chmod 644 /jre/lib/security/blocked.certs \
56+
&& rm /tmp/emudhra-blocked.certs
57+
4758
# Extract java SSL certs
4859
FROM gcr.io/distroless/java-base-debian12:debug AS ssl
4960

‎java-21/blocked.certs‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
Algorithm=SHA-256
2+
0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
3+
03DB9E5E79FE6117177F81C11595AF598CB176AF766290DBCEB2C318B32E39A2
4+
08C396C006A21055D00826A5781A5CCFCE2C8D053AB3C197637A4A7A5BB9A650
5+
10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B
6+
14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD
7+
169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240
8+
1C5E6985ACC09221DBD1A4B7BBC6D3A8C3F8540D19F20763A9537FDD42B4FFE7
9+
1F6BF8A3F2399AF7FD04516C2719C566CBAD51F412738F66D0457E1E6BDE6F2D
10+
21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832
11+
2A464E4113141352C7962FBD1706ED4B88533EF24D7BBA6CCC5D797FD202F1C4
12+
31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133
13+
33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09
14+
37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8
15+
3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66
16+
3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829
17+
3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF
18+
3E11CF90719F6FB44D94EAC9A156B89BEBE7B8598F28EC58913F2BFCAF91D0C0
19+
423279423B9FC8CB06F1BB7C3B247522B948D5F18939F378ECC901126DE40BFB
20+
42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
21+
432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
22+
450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2
23+
45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE
24+
4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
25+
4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE
26+
4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C
27+
4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176
28+
50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A
29+
535D04DFCE027C70BD5F8A9E0AD4F218E9AFDCF5BBCF9B6DE0D81E148E2E3172
30+
558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB
31+
568FAF38D9F155F624838E2181B1CEB4D8459305EE652B0F810C97C3611BFE19
32+
579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512
33+
585CFE6B7436CBD4E732763A2137D7F49599BA9B1790E688FCEC799C58EB84A6
34+
59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66
35+
5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE
36+
5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B
37+
5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699
38+
62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72
39+
71CB00749B9130FB2707A2664BFF958D0FCC8E161D9674C7450BA0FC2BEAF9D3
40+
7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489
41+
75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536
42+
76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645
43+
7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2
44+
84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD
45+
8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF
46+
8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0
47+
8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82
48+
912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1
49+
98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
50+
9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
51+
9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7
52+
9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC
53+
9FADCE80D62A959F9930D748488C1E22E821F4E1E4A43584B848C2FC11E04D77
54+
A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC
55+
A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5
56+
A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC
57+
A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8
58+
A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8
59+
A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9
60+
A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083
61+
A90132CEA1D4F7185E4F688EFFD16F6AC14DFD78356A807599A5DABBEEF3333E
62+
AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986
63+
B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C
64+
B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD
65+
B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
66+
C0D1F42B9F4BF7ACC045B7BB5D4805E10737F67B6310CE505248D543D0D5FE07
67+
C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0
68+
C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222
69+
C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33
70+
CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
71+
CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978
72+
D0156949F1381943442C6974E9B5B49EF441BB799EF20477B90A89C3F33620CE
73+
D151962D954970501C60079258EBCFA38502E0A9F03CD640322B08C0A3117FE5
74+
D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F
75+
D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967
76+
D6CEAE5D9E047FAF7D797858D229AC991AD44316D1E2A37A21926D763153593A
77+
D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8
78+
DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE
79+
E0E740E4B0F8B3548181FF75B5372FAF4C70B99EC995D694ED0FB91B03FF8D21
80+
E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
81+
EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C
82+
EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E
83+
F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7
84+
FBB12938ABD86C125796EDF4162D291028890A7D6C0C1CCA75FD4B95EBFA7A1A
85+
FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD
86+
FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F
87+
FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B

0 commit comments

Comments
 (0)